Negative number sent to TCP/4000 of the gateway causes it to crash.
vulners.com/securityvulns/securityvulns:doc:4722